Data Processing Agreement

1. Parties, application and precedence

This Data Processing Agreement (“DPA”) forms part of the agreement between Daryn Lab Inc. (“Processor”) and the customer (“Controller”) insofar as Daryn Lab processes Customer Personal Data on the customer’s behalf. It does not govern personal data for which Daryn Lab independently determines purposes and means (including its own account administration, billing, fraud prevention and corporate records). In case of inconsistency on processing of Customer Personal Data, this DPA prevails over general platform terms, subject to any mandatory transfer clauses.

This DPA does not transfer intellectual property or confer ownership of Customer Personal Data on Processor. Proprietary platform technology and contributor assignments are governed by separate agreements, including the intercompany R&D/IP/NDA/DPA arrangements.

2. Definitions and roles

“Customer Personal Data” means personal data contained in customer application databases, project materials or prompts processed on documented instructions for service delivery. “Subprocessor” means a third party engaged by Processor to process such data. The customer is controller or acts under authority of another controller and is responsible for lawful instructions, notices, consents, data minimization and rights of end users. The parties do not become joint controllers merely by signing this DPA.

For connected internet stores, Customer Personal Data includes shopper contact and customer IDs, order number/status/total/currency/item count, abandoned-checkout recovery data, messaging identifiers, conversations and attachments, consent records and staff annotations. The store acts as controller and determines the purposes of messaging; Daryn Lab acts as processor. Detailed product contents, delivery addresses and shopper IP addresses are not retained in this integration.

3. Instructions and permitted processing

Processor shall process Customer Personal Data only on documented instructions, including instructions inherent in customer configuration, deployment, connected applications, use of AI gateway, support and deletion, unless applicable law requires otherwise. Processor will notify the customer if it believes an instruction infringes applicable data protection law, unless prohibited. Processor may access data to deliver, maintain, secure, back up and restore the service; no independent advertising or foundation-model training use is permitted.

Documented instructions for connected internet stores include channel selection, order-linked support, consent-based abandoned-checkout reminders, messaging automations, authorized access and erasure requests. The store is responsible for lawful channel-specific consent; processor-side safeguards do not replace that obligation.

4. Confidentiality and security

Processor shall restrict access to personnel subject to confidentiality duties and implement measures appropriate to risk, including role-based access, separate application databases and credentials, TLS 1.2+, provider-managed encryption at rest, Key Vault secrets, audit logging, code scanning and backup controls. Detailed measures and limitations are set out in Schedule B.

For store data, routine support access requires the store owner’s authorization for 24 hours or seven days and can be revoked at any time. Emergency access without prior authorization is limited to one hour with a written reason and an auditable record visible to the store owner. Credentials are kept in Azure Key Vault, passwords as hashes, and traffic uses HTTPS/TLS 1.2 or higher; provider-managed encryption applies at rest.

5. Subprocessors

Customer grants general written authorization only for subprocessors identified as confirmed in Schedule C. Proposed additions or replacements require advance notice and a reasonable opportunity to object on documented data-protection grounds. Processor shall impose appropriate contractual data-protection obligations on authorized subprocessors and remain responsible as required by applicable law. Providers classified as independent controllers or customer-directed integrations are not deemed authorized subprocessors merely because they appear in the provider inventory.

Affiliates of Daryn Lab may access Customer Personal Data only on documented instructions, subject to appropriate confidentiality and security obligations, an authorized subprocessing arrangement where applicable, and a valid international-transfer mechanism; affiliation alone does not authorize access.

Where a store enables messaging channels, data may be disclosed to Meta, ChatFlow, Zernio or Telegram as required for message delivery.

6. International transfers

Restricted international transfers, including any remote access by affiliate support personnel from outside the EEA or processing outside the EEA (European Economic Area) through Azure OpenAI GlobalStandard, shall be assessed and supported by a valid transfer mechanism before commencement where required by law. Where applicable, the parties shall complete and execute or validly incorporate the EU Standard Contractual Clauses (Decision (EU) 2021/914), the appropriate modules and annexes, and the UK Addendum or IDTA. This DPA alone does not execute those instruments. The outstanding transfer particulars are expressly reserved in Schedule D.

7. Assistance and rights requests

Processor shall provide reasonable assistance, taking into account the nature of processing and available information, with data subject requests, DPIAs, supervisory consultations and demonstration of compliance. If a data subject contacts Processor about Customer Personal Data, Processor may refer the request to Customer unless law requires direct action. Customer bears responsibility for responding to end users and for deletion across each connected application.

For connected stores, Processor routes verified shopper access requests to authorized personnel for manual retrieval and provision to the store; automated shopper export is not currently available. In the implemented shopper-erasure workflow, contact details and abandoned-checkout recovery links are removed.

8. Personal data breaches

Processor shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The initial notice shall contain reasonably available information about the nature of the incident, affected data categories, mitigation measures and a relevant contact. Missing details shall not delay initial notice; Processor shall provide updates as information becomes available and reasonably assist Customer with its legal notification obligations. No separate 72-hour clock starting only after final confirmation of Customer impact is created by this DPA.

9. Return, deletion and backup lifecycle

For general Beyonder applications, the currently described export process provides an available period of at least 30 days following application archiving and may maintain an export archive for up to 12 months. A 90-day production-data deletion period remains a proposed target, not a verified automated guarantee. Any applicable erasure request, legal retention requirement and backup lifecycle shall be assessed separately. These general application targets do not extend mandatory deadlines for connected-store data or override the special rules below.

For connected internet stores, sending-module message text and attachments are retained for 30 days; store-inbox conversations for 12 months by default, configurable by the store from 1 to 36 months; synchronized shopper/order/checkout metadata while the integration is active, subject to applicable erasure requests; server logs for 30 days; daily backups for 30 days and monthly backups for up to 12 months. On a verified shopper-erasure request, the implemented process removes contact details and checkout recovery links . Following the applicable store-erasure request, the implemented process removes store credentials, shopper contacts and order totals. Retained technical identifiers may still be personal data. Protected backup residuals are removed through the applicable rotation process unless a different legal requirement applies. These special rules prevail over general application targets without extending mandatory erasure deadlines.

10. Audit and compliance evidence

On reasonable notice, Processor shall make available appropriate security documentation and information needed to demonstrate compliance, subject to confidentiality, security and third-party rights. Remote documentary review is preferred; on-site inspection is subject to a mutually agreed scope, frequency, costs and protections, without prejudice to mandatory legal rights. The process of obtaining SOC 2 and ISO 27001 certifications, as well as an external penetration testing report, is currently under consideration.

11. Liability, Governing Law and Disputes

11.1. The limitations and exclusions of liability under the General Terms or applicable principal agreement shall apply to this DPA, and claims under both agreements shall be subject to the same aggregate liability cap, except to the extent prohibited by applicable law.

11.2. Nothing in this DPA shall limit mandatory rights of data subjects or supervisory authorities, or override applicable EU Standard Contractual Clauses or UK international data transfer instruments.

11.3. This DPA shall be governed by the laws of the State of New York, and disputes shall be resolved in accordance with the governing law and dispute resolution provisions of the General Terms or applicable principal agreement, subject to mandatory applicable law and international data transfer instruments.

11.4. In the event of any conflict concerning the processing of Customer Personal Data, this DPA shall prevail over the General Terms or applicable principal agreement. Applicable EU Standard Contractual Clauses and UK international data transfer instruments shall prevail to the extent required by their terms. Contract notices: [email protected]; privacy requests: [email protected]; incidents: [email protected].

Schedule A — Processing particulars

Subject matter: hosting, generation, deployment, maintenance, AI gateway, support, backup and deletion of customer applications. Duration: service term and documented retention periods. Data subjects: customer personnel and end users of applications. Data: identifiers, contacts, business records, user-entered content, prompts, files and any other data chosen by Customer. Operations: collection, storage, access, transmission to instructed AI services, retrieval, backup, restoration, export and erasure. Sensitive data is prohibited in standard self-service except as separately agreed for enterprise customers; payment card data is prohibited.

Connected-store processing also includes order-linked messaging, abandoned-checkout reminders, shopper consent and opt-out management, and AI-assisted customer support where enabled. The data categories and purposes are limited to the store’s configuration and documented instructions.

Schedule B — Technical and organizational measures

Implemented measures include access controls and confidentiality obligations; store-owner-approved support access for 24 hours or seven days (revocable), with one-hour documented emergency access; TLS 1.2+ in transit; provider-managed encryption at rest; Azure Key Vault for secrets; password hashing; activity logging; and provider-managed backups. Daily backup retention is 30 days and monthly backup retention is up to 12 months. Proposed but not confirmed: TOTP, WAF, external penetration testing, restoration drills and any 24-hour RPO/RTO objective.

Schedule C — Subprocessors and other recipients

Subprocessors and other recipients:

Stripe applies to direct Beyonder billing and is not the internet-store marketplace billing provider.

Messaging recipients, when enabled: Meta (WhatsApp, Instagram, Facebook Messenger), ChatFlow, Zernio and Telegram. Optional PostHog, Meta Pixel and Google Analytics relate to login/registration analytics where enabled, not to analytics inside the internet-store messaging module.

Schedule D — Transfer instruments and contacts

Where a restricted transfer requires it, the parties will complete and incorporate the EU Standard Contractual Clauses (Decision (EU) 2021/914), with the appropriate modules and annexes, and the UK Addendum where applicable. Daryn Lab Inc. acts as importer for Customer Personal Data exported from the EEA or the UK. Daryn Lab relies on its providers’ standard data processing terms and transfer mechanisms; Schedule C lists the providers and their locations. Contacts for this DPA: [email protected].

Effective date: 8 November 2026.